From d08c3b78b8c46a01b8fa59037a0d9fbb777fb465 Mon Sep 17 00:00:00 2001 From: Vinit Agnihotri Date: Tue, 10 Jul 2007 13:04:59 +0300 Subject: UBI: fix overflow bug I was experiencing overflows in multiplications for volume->used_bytes in vmt.c & vtbl.c, while creating & resizing large volumes. vol->used_bytes is long long however its 2 operands vol->used_ebs & vol->usable_leb_size are int. So their multiplication for larger values causes integer overflows. Typecasting them solves the problem. My machine & flash details: 64Bit dual-core AMD opteron, 1 GB RAM, linux 2.6.18.3. mtd size = 6GB, volume size= 5GB, peb_size = 4MB. heres patch which does the fix. Signed-off-by: Vinit Agnihotri Signed-off-by: Artem Bityutskiy --- drivers/mtd/ubi/vmt.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'drivers/mtd/ubi/vmt.c') diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c index d62dac90e10..ea0d5c825ab 100644 --- a/drivers/mtd/ubi/vmt.c +++ b/drivers/mtd/ubi/vmt.c @@ -280,7 +280,8 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) if (vol->vol_type == UBI_DYNAMIC_VOLUME) { vol->used_ebs = vol->reserved_pebs; vol->last_eb_bytes = vol->usable_leb_size; - vol->used_bytes = vol->used_ebs * vol->usable_leb_size; + vol->used_bytes = + (long long)vol->used_ebs * vol->usable_leb_size; } else { bytes = vol->used_bytes; vol->last_eb_bytes = do_div(bytes, vol->usable_leb_size); @@ -538,7 +539,8 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs) if (vol->vol_type == UBI_DYNAMIC_VOLUME) { vol->used_ebs = reserved_pebs; vol->last_eb_bytes = vol->usable_leb_size; - vol->used_bytes = vol->used_ebs * vol->usable_leb_size; + vol->used_bytes = + (long long)vol->used_ebs * vol->usable_leb_size; } paranoid_check_volumes(ubi); @@ -739,7 +741,7 @@ static void paranoid_check_volume(struct ubi_device *ubi, int vol_id) goto fail; } - n = vol->used_ebs * vol->usable_leb_size; + n = (long long)vol->used_ebs * vol->usable_leb_size; if (vol->vol_type == UBI_DYNAMIC_VOLUME) { if (vol->corrupted != 0) { ubi_err("corrupted dynamic volume"); -- cgit